2. Don't install anything optional.
There, that's the standard library.
Some ecosystems will never add something like NaCl/libsodium to the standard library because the main developer experience requires package management, but that's irrelevant to the very narrowly defined claim being made.
What if my package manager includes libs like those under "x"? Or if it excludes certain libs? Homebrew is capable of this for many languages.
What if my language includes different libs depending on install target, like targeting embedded environments? I think Rust does this.
I think there is a large grey area being overlooked.
EDIT: This is particularly true in PHP land. If I just install the meta php package in most distributions, I will get a different set of extensions included.
Compile from src. Use the default options.
Did any discussion on this possibility come up as I can see cryptography requiring a quicker update cycle when bugs are found then a schedualed language release can give.